CVE-2026-40564

Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files from the operator pod's filesystem and pull content from any backing store reachable through Flink's pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0. Users are recommended to upgrade to version 1.15.0, which fixes the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/jvxs2kh2o60sl7qkl5nss4r5phzfl4cz	Mailing List
http://www.openwall.com/lists/oss-security/2026/05/26/6	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:flink_kubernetes_operator:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-26 16:16

Updated : 2026-07-24 11:10

NVD link : CVE-2026-40564

Mitre link : CVE-2026-40564

CVE.ORG link : CVE-2026-40564

JSON object : View

Products Affected

apache

flink_kubernetes_operator

CWE

CWE-552

Files or Directories Accessible to External Parties

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-40564", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40564", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T14:11:43.962546Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Flink Kubernetes Operator", "versions": [{"status": "affected", "version": "1.3.0", "lessThan": "1.15.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-26T16:16:24.590", "references": [{"url": "https://lists.apache.org/thread/jvxs2kh2o60sl7qkl5nss4r5phzfl4cz", "tags": ["Mailing List"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/26/6", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-552"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.\n\nThe FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses.\u00a0\u00a0This lets a user with CR create permissions read files from the operator pod's filesystem and pull content from any backing store reachable through Flink's pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses\u00a0there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0.\n\nUsers are recommended to upgrade to version 1.15.0, which fixes the issue."}, {"lang": "es", "value": "Archivos o directorios accesibles a terceros externos, vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en Apache Flink Kubernetes Operator.\n\nEl jarURI de FlinkSessionJob actualmente no se valida para que apunte a archivos o direcciones propiedad del usuario. Esto permite a un usuario con permisos de creaci\u00f3n de CR leer archivos del sistema de archivos del pod del operador y extraer contenido de cualquier almac\u00e9n de respaldo accesible a trav\u00e9s de la capa de sistema de archivos conectable de Flink y acceder a ellos a trav\u00e9s del trabajo Flink enviado. Adem\u00e1s, para la obtenci\u00f3n desde direcciones HTTP/HTTPS, actualmente no hay una lista de permitidos para el esquema URI, ninguna comprobaci\u00f3n de host, ninguna restricci\u00f3n de rango IP y ninguna protecci\u00f3n contra el direccionamiento del URI a direcciones internas o de enlace local. Este problema afecta a Apache Flink Kubernetes Operator: desde 1.3.0 antes de 1.15.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.15.0, que corrige el problema."}], "lastModified": "2026-07-24T11:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:flink_kubernetes_operator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDD73EA9-97EA-48BD-A4A4-4A6CFA3C3AD5", "versionEndExcluding": "1.15.0", "versionStartIncluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}